4. Automating
with SIMATIC
Controllers, Software, Programming,
Data Communication, Operator Control
and Process Monitoring
by Hans Berger
5th
revised and enlarged edition, 2013
Publicis Publishing
6. Foreword
5
Foreword
The automation of industrial plants results in a growing demand for components
which are increasingly different and more complex. Therefore a new challenge
nowadays is not the further development of highly specialized devices but the op-
timization of their interaction.
The Totally Integrated Automation concept permits uniform handling of all auto-
mation components using a single system platform and tools with uniform opera-
tor interfaces. These requirement is fulfilled by the new SIMATIC, which provides
uniformity for configuration, programming, data management, and communica-
tion.
The STEP 7 engineering software is used for the complete configuration and pro-
gramming of all components. Optional packages for expanding functionalities can
also be introduced seamlessly in STEP 7 if they have the same operating philoso-
phy. The SIMATIC Manager of STEP 7 V5.5 and the TIA Portal of STEP 7 V11 coordi-
nate all tools and centrally manage any automation data. All tools have access to
this central data management so that duplicate entries are avoided and coordina-
tion problems are prevented right from the start.
Integrated communication between all automation components is a prerequisite
for “distributed automation”. Communication mechanisms that are tuned to one
another permit the smooth interaction of controllers, visualization systems, and
distributed I/O without additional overhead. This puts the seminal concept of “dis-
tributed intelligence” within reach. Communication with SIMATIC is not only uni-
form in itself, it is also open to the outside. This means that SIMATIC applies
widely-used standards such as PROFIBUS for field devices and Industrial Ethernet
and TCP/IP protocol for the best possible connections to the office world and thus
to the management level.
The 5th
edition of this book provides an overview of the structure and principle of
operation of a modern automation system with its state-of-the-art controllers and
HMI devices, and describes the expanded facilities of distribution with PROFIBUS
and PROFINET. Using the SIMATIC S7 programmable controllers as example, this
book provides an insight into the hardware and software configuration of the con-
troller, presents the programming level with its various languages, explains the
exchange of data over networks, and describes the numerous possibilities for op-
erator control and monitoring of the process.
Erlangen, July 2012 Hans Berger
10. 1 Introduction
9
1 Introduction
1.1 Components of the SIMATIC Automation System
The SIMATIC automation system consists of many components that are matched
to each other through the concept of “Totally Integrated Automation” (TIA). Totally
Integrated Automation means automation with integrated configuration, pro-
gramming, data storage, and data transfer.
As programmable logic controllers (PLCs), the SIMATIC S7 controllers form the
basis of the automation system. SIMATIC S7-200 and S7-1200 are micro systems
for the low-end performance range – as a stand-alone solution or in a bus net-
work. The SIMATIC S7-300 with standard CPUs and compact CPUs is the system so-
lution with a focus on the manufacturing industry. And as the top-level device
with the highest performance power of the SIMATIC controllers, the SIMATIC
S7-400 enables system solutions for the manufacturing and process industries.
SIMATIC WinAC (Windows Automation Center) combines the functions of open-
loop control, technology, data processing, visualization, and communication on
one personal computer (PC) and is the first choice if you have to handle PC appli-
cations in addition to classic PLC tasks.
SIMATIC WinCC (Windows Control Center) is the engineering and runtime soft-
ware for PC-based devices. HMI devices are configured with WinCC as engineering
software, while WinCC as runtime software turns personal computers into HMI de-
vices for industrial plants and processes.
SIMATIC HMI stands for Human Machine Interface and is the interface between
operators and the machine. From the simplest text display to the operator station
with powerful graphics, the human-machine interface provides all the facilities
you need for operating and monitoring a machine or plant. Powerful software in-
dicates the state of the plant with event and fault messages, manages recipes and
measured value archives, and supports plant operators with troubleshooting, ser-
vicing, and maintenance.
SIMATIC NET links all SIMATIC stations and ensures trouble-free data communi-
cation. Various bus systems with graded performance also allow third-party devic-
es to be connected, whether field devices in the plant or process PCs connected at
the control level. Data traffic can go beyond the limits of various subnets, such as
the transfer of automation data such as measured values and alarms or the com-
missioning and troubleshooting of a central location in the network group.
11. 1 Introduction
10
SIMATIC DP stands for distributed I/O. It expands the interface between the cen-
tral controller and machine or plant with I/O modules directly on site. This distrib-
uted I/O, which is spatially separate from the controller, is connected to the central
control via the PROFIBUS DP and PROFINET IO bus systems – thus reducing wiring
overhead. SIMATIC controllers, ET 200 I/O system modules, and third-party devic-
es can be used as distributed I/O.
The STEP 7 engineering software is used to configure, parameterize, and pro-
gram SIMATIC components. The SIMATIC Manager in the “classic” STEP 7 version
and the TIA Portal in the updated version are the central tools for managing au-
tomation data and related software editors in the form of a hierarchically orga-
nized project.
Fig. 1.1 Components of the SIMATIC automation system
S
S
S
SIMATIC HMI station
SIMATIC S7 station SIMATIC PC station
S
S
S
SIMATIC NET
SIMATIC DP STEP 7
.
S
SIMATIC automation system
S
12. 1.2 From the Automation Task to the Finished Program
11
The main activities performed with STEP 7 are:
b Configuring the hardware
(arranging modules in racks and parameterizing the module properties)
b Configuring the communication connections
(defining communication partners and connection properties)
b Programming the user program
(creating the control software and testing the program)
The user program can be created in the programming languages ladder logic
(LAD), function block diagram (FBD), statement list (STL), and structured control
language (SCL) as “logic control”, or in the programming language GRAPH as
“sequence control”
1.2 From the Automation Task to
the Finished Program
When you start to solve an automation problem, you have to ask yourself what
type of PLC you are going to use. If the machine to be controlled is a small one,
will an S7-200 be big enough or do you need an S7-300? Is it better to control the
plant with an S7-400 or with a pair of S7-300s? Compact central I/Os in the control
cabinet or distributed I/Os in the plant?
The following is a general outline of the steps that lead from the automation task
to the finished program. In individual cases, specific requirements must be met.
Choosing the hardware
There are many criteria for selecting the type of controller. For “small” controls
the main criteria are the number of inputs and outputs and the size of the user
program. For larger plants you need to ask yourself whether the response time is
short enough, and whether the user memory is big enough for the volume of data
to be managed (recipes, archives). To be able to estimate the resources you need
from the requirements alone, you need a lot of experience of previous automation
solutions; there is no rule of thumb.
A production machine will probably be controlled by a single station. In this case,
the number of inputs/outputs, the size of the user memory and, possibly, the
speed (response time) will enable you to decide between the S7-200, S7-1200,
S7-300, or the S7-400. How is the machine controlled? What HMI devices will be
used?
Spatially distributed systems raise the question of what is overall the better value:
the use of centralized or distributed I/O. In many cases distributed I/O not only re-
duces the wiring overhead needed, but also the response time and the engineer-
ing costs. This is possible due to the use of “intelligent” I/O devices with their own
user program for preprocessing of signals “on site”.
13. 1 Introduction
12
Distributed automation solutions have advantages: The user programs for the dif-
ferent plant units are smaller with faster response times, and can often be com-
missioned independently of the rest of the plant. The necessary exchange of data
with a “central controller” is particularly easy within the SIMATIC system using
standardized bus systems.
Which programming language?
The choice of programming language depends on the task. If it mainly consists of
binary signal processing, the graphical programming languages LAD (Ladder Log-
ic) and FBD (Function Block Diagram) are ideal. For more difficult tasks requiring
complex variable handling and indirect addressing, you can use the STL (State-
ment List) programming language, which has an assembly language format. SCL
(Structured Control Language) is the best choice for people who are familiar with
a high-level programming language and who mainly want to write programs for
processing large quantities of data.
If an automation task consists of sequential processes, GRAPH can be used. GRAPH
creates sequencers with steps and step enabling conditions that are processed se-
quentially. All programming languages – including GRAPH – can be used together
in a user program. Every program section and “block” can be created with the suit-
able programming language, depending on requirements.
Creating a project
All the data for your automation solution is collected together in a “project”. You
create a project using STEP 7. A project is a (software) folder in which all the data
is stored in a hierarchic structure. The next level down from the project are the
“stations”, which in turn contain one or more CPUs with a user program. All these
objects are folders which can contain other folders or objects that represent the
automation data on the screen. You use menu commands to insert new objects,
open these objects, and automatically start the tool required to work with them.
An example: The user program consists of blocks, which are individual program
sections with limited functions. All programmed blocks are listed in the block
folder. Depending on the programming language used, double-clicking on a block
starts the suitable program editor, with which you can alter or expand the pro-
gram in the block, guided by menus and supported by online help.
Configuring hardware
A project must contain at least one station, either a programmable logic control
(PLC) station or a human-machine interface (HMI) station. A PLC station is re-
quired to control a machine or plant. After the station is opened, a rack is shown
onscreen, to which you can add the desired modules. To do this, drag the required
modules from the hardware catalog to the relevant slot. If needed, change the de-
fault module properties to meet your requirements.
A project can contain additional stations that you configure in the same manner as
the first station. The data transfer between the stations takes place via a subnet.
14. 1.3 How Does a Programmable Logic Controller Work?
13
Using network configuration, you connect the bus interfaces of the “communica-
tion modules” to the subnet and thus create the network group.
Writing, debugging and saving the user program
The user program is the totality of all instructions and declarations programmed
by the user for signal processing by means of which the machine or plant to be
controlled is influenced in accordance with the control task. Large, complex tasks
are easier to solve if they are divided into small, manageable units, which can be
programmed in “blocks” (subroutines). The division can be process-oriented or
function-oriented. In the first case, each program unit corresponds to a part of the
machine or plant (mixer, conveyor belt, drilling assembly). In the second case, the
program is divided up according to control functions, for example signaling, com-
munication, operating modes. In practice, mixed forms of the two structuring
concepts are generally used.
In the user program, signal states and variable values are used that you should
preferably address with a name (symbolic addressing). A name is assigned to a
memory location in the symbol table or in the PLC variable table. You can then use
the name in the program. After you have entered the user program you “compile”
it so that it can process the relevant control processor. The user program is creat-
ed “offline”, without a connection to a controller, and is saved to the hard disk of
the programming device.
You can test smaller programs, as well as individual parts of larger programs, of-
fline with the PLCSIM simulation software and thus find and correct any possible
errors before the user program is used in the machine or plant.
For commissioning, connect the programming device with the CPU, transfer the
program to the CPU user memory, and test it using the STEP 7 testing functions.
You can monitor and change the variable values and monitor the processing of the
program by the control processor. Comprehensive diagnostic functions allow
quick identification of error location and cause.
After commissioning is concluded, you document the project, e. g. in circuit man-
ual format, by means of DOCPRO. With the “classic” version of STEP 7, you can ar-
chive an entire project, including documentation, in compressed form.
1.3 How Does a Programmable Logic Controller
Work?
In conventional control engineering, a control task is solved by wiring up contac-
tors and relays individually, i.e. depending on the task. They are therefore re-
ferred to as contactor and relay controllers, and electronic controllers assembled
from individual components are referred to as hard-wired programmed control-
lers. The “program” is in the wiring. Programmable logic controllers, on the other
hand, are made up of standard components that implement the desired control
function by means of a userprogram.
15. 1 Introduction
14
SIMATIC S7 is an automation system that is based on programmable logic control-
lers. The solution of the control task is stored in the user memory on the CPU in
the form of program instructions. The control processor reads the individual in-
structions sequentially, interprets their content, and executes the programmed
function.
The CPU module contains an additional program: the operating system. It ensures
the execution of the device-internal operating functions, such as communication
with the programming device and backing up data in the event of power failure.
The operating system also initiates the processing of the user program, either re-
curring cyclically or dependent on a trigger event such as an alarm.
Cyclic program processing
The prevalent processing type of the user program for programmable logic con-
trollers is cyclic program processing: After the user program has been completely
processed once, it is then processed again immediately from the beginning. The
user program is also executed if no actions are requested “from outside”, such
as if the controlled machine is not running. This provides advantages when pro-
gramming: For example, you program the ladder logic as if you were drawing a
circuit diagram, or program the function block diagram as if you were connecting
electronic components. Roughly speaking, a programmable logic controller has
characteristics like those of a contactor or relay control: The many programmed
operations are effective quasi simultaneously “in parallel”.
Fig. 1.2 Execution of the user program in a SIMATIC controller
Cycle start
Switching-on
<Interrupt> Interruption
Interruption
<Error>
Operating
mode
Operating
mode
RUN
Interrupt handler
Main program
Program execution modes
STARTUP
Error program
Start-up routine
16. 1.4 The path of a binary signal from the sensor to the program
15
After the power is switched on and the operating function test runs, the operating
system starts an (optional) start-up routine once (Fig. 1.2). The main program is
next in the sequence. If it has been processed to the end, processing begins again
immediately at the start of the program. The main program can be interrupted by
alarm or error events. The operating system then starts an interrupt handler or
error program. If the interruption-controlled program has been completely pro-
cessed, the program processing continues from the point of interruption in the
main program. A priority scheduler controls the program execution order if sever-
al interrupt events occur simultaneously.
The user program is made up of blocks. There are several block types. Organiza-
tion blocks represent the interface to the operating system. After a start event oc-
curs (power up, cycle start, alarm, error), the operating system calls the associated
organization block. It contains the appropriate user program for the event. An or-
ganization block only has to be programmed if the automation solution requires
it. The program in an organization block can, if needed, be structured by function
blocks (blocks with static local data) and functions (blocks without static local da-
ta). Data blocks in the user memory or the bit memory address area in the system
memory are available to store user data.
1.4 The path of a binary signal from the sensor
to the program
In order to do its job, the control processor in the controller needs to be connected
to the machine or plant it is controlling. I/O modules that are wired to the sensors
and actuators create this connection.
Connection to the programmable logic controller, module address
When wiring the machine or plant, you define which signals are connected to the
programmable logic controller, and where. An input signal, e.g. the signal from
pushbutton +HP01-S10 with the significance “Switch on motor”, is connected to a
specific terminal on an input module (Fig. 1.3).
Each module is located in a particular slot on the rack, the number of which is the
slot address. In addition, each I/O module has a so-called “logical” address. The us-
er program uses this address to address a signal of the module. In the logical ad-
dress, the binary signals are aggregated into bytes (bundles of eight bits). Bytes
are numbered starting from zero – even with gaps. The bit address is counted
from 0 to 7 for each byte.
You determine the slot address by plugging the module into a certain place on the
rack. STEP 7 assigns the logical address consecutively, which you can change in
the configuration table. The first byte of the module receives the module start ad-
dress, which is the lowest address of the module. If a module has more bytes, the
byte addresses are automatically incremented. In the example, the module has the
module start address four – either set by STEP 7 as default or set by you – and the
17. 1 Introduction
16
next byte thus automatically has the number five. The “switch on motor” signal is
connected to terminal two of the second byte (relative byte 1). By specifying the
module address as 4, you are given the address of the signal: “Input in byte 5 to bit
2” or in short: I 5.2.
Symbolic address
The address “I 5.2” denotes the memory location and is the absolute address. It is
much easier if you can address this signal in the program with a name that match-
es the meaning of the signal, for example “switch on motor”. This is the symbolic
address. You can find the assignment of absolute addresses to symbolic addresses
in the symbol table or the PLC variable table. In this table, the “global” symbols
are defined; these are the symbols that are valid in the entire user program. You
specify the symbols that are valid for only one block (“local” symbols) when pro-
gramming the block.
Fig. 1.3 Path of a signal from the sensor to its use in the program
System memory
“Motor ON” I 5.2
Symbolic addressing Absolute addressing
Motor ON
5 I 5.2
DI 16 BOOL
4
0
0
7
7
0
0
7
7
Byte 4
Relative
Byte 0
Byte 5
Relative
Byte 1
Input modul
Sensor
+HP01
-S10
Signal path from the sensor to the program
7 6 5 4 3 2 1 0
Byte 4
Byte 5
Bit
18. 1.5 Data management in the SIMATIC automation system
17
Process images
When you use the signal “switch on motor” or I 5.2 in the program, you do not
address the signal memory in the module but a storage area within the CPU. This
storage area is referred to as the “process image”. It is also available for the out-
puts, which in principle are treated in the same way as the inputs.
The CPU operating system automatically transfers the signal states between the
modules and the process image in each program cycle. It is also possible to ad-
dress the signals directly on the modules from the user program. However, the
use of a process image has advantages compared to direct access, including much
faster access to the signal states and the steady signal state of an input signal dur-
ing a program cycle (data consistency). The disadvantage is the increased re-
sponse time, which is also dependent on the program execution time.
1.5 Data management in the SIMATIC
automation system
The automation data is present in various memory locations in the automation sys-
tem. First of all, there is the programming device. All automation data of a STEP 7
project is saved on its hard disk. Configuration and programming of the project da-
ta with STEP 7 are carried out in the main memory of the programming device
(Fig. 1.4).
Fig. 1.4 Data management in the SIMATIC automation system
The work memory contains the
part of the control program
(program code and data) that is
processed during runtime
.
The load memory contains
the project data transferred
to the CPU.
The offline project data
is saved on the hard disk.
All project data is executed
in the programming device's
main memory
.
Programming device
CPU
Data management in the SIMATIC programmable controller
19. 1 Introduction
18
The automation data on the hard disk is also referred to as the offline project data.
Once STEP 7 has appropriately compiled the automation data, this can be down-
loaded to a connected programmable logic controller. The data downloaded into
the user memory of the CPU is known as the online project data.
The user memory on the CPU is divided into two components: The load memory
contains the complete user program, including the configuration data, and the
work memory contains the executable user program with the current control data.
The load memory of the CPU 1200 can be expanded with a plug-in memory card. For
the CPU 300, the load memory is on the memory card, which therefore must always
be inserted in the CPU for use. The memory card for the CPU 1200 and CPU 300 is
an SD Card, for failsafe storage of the automation data. On the CPU 400, the mem-
ory card expands the load memory; here, the memory card is a RAM card (so that
the user program can be changed during testing), or a FEPROM card (for failsafe
storage of the user program).
20. 2 SIMATIC Controllers – the Hardware Platform
19
2 SIMATIC Controllers –
the Hardware Platform
SIMATIC controllers – the core of the automation systems – control production
machines, manufacturing plants, or industrial processes. The following descrip-
tion mainly refers to programmable logic controllers (PLC). Siemens also offers
PC-based SIMATIC controllers.
SIMATIC S7 are programmable logic controllers (PLCs), which are available in
four designs:
b SIMATIC S7-200, the compact micro PLC
b SIMATIC S7-1200, the modular „micro PLC“,
b SIMATIC S7-300, the modular PLC of the mid performance range
b SIMATIC S7-400, the modular PLC of the upper performance range
The S7-200 station consists of a basic unit and can be expanded with additional
modules. In S7-300/400 stations, the power supply unit, the CPU module and the
I/O modules are installed in the same mounting rack. This centralized configura-
tion can be extended with expansion racks for the installation of additional I/O
modules. The expansion rack may be a remote installation, that is it can be placed
at a distance from the central rack. You use the STEP 7 Micro programming lan-
guage to program the SIMATIC S7-200 controller. STEP 7 with its different pro-
gramming languages is provided for the controllers of the SIMATIC S7-300/400 se-
ries.
PC-based automation is the umbrella term for PLCs based on a personal comput-
er (PC):
b The industrial PC is available as a Rack PC or Box PC.
b The SIMATIC Panel PC is a combination of HMI device and controller.
b SIMATIC WinAC is the generic term for the program packages of SIMATIC PC-
based Automation. WinAC runs on a standard PC under a Windows operating
system. Distributed I/O modules form the link to the process.
With SIMATIC PC-based Control, the controller can take the form of a purely
software solution (Software PLC) or a plug-in card (Slot PLC).
SIMATIC DP are modules installed on site at the machine or in the plant and are
connected to the master station via PROFIBUS DP and/or PROFINET IO. Many
SIMATIC CPUs feature an integrated PROFIBUS or PROFINET interface, which
greatly facilitates the connection of distributed I/O. Since operation on the
21. 2 SIMATIC Controllers – the Hardware Platform
20
PROFIBUS and PROFINET is standardized independent of the vendor, it is also pos-
sible to connect third-party devices to a SIMATIC controller.
2.1 Components of a SIMATIC Station
A complete programmable controller including all I/O modules is referred to as a
“station”. The core is the CPU, which is expanded with I/O modules if needed.
The following list shows the components a SIMATIC station can consist of:
b Racks
These accommodate the modules and form the basis for central and expansion
units. The S7-1200 and S7-300 use a simple mounting rail; its length is deter-
mined by the number and width of the modules. The S7-400 uses an aluminum
rack that has a defined number of slots with backplane bus and bus connectors.
b Power supply (PS)
It provides the internal supply voltage; the input voltage is either 120/230 V AC
voltage or 24 V DC voltage.
b Central processor unit (CPU)
This stores and processes the user program; communicates with the program-
ming device and any other stations over the MPI bus; controls the central and
distributed I/O modules; and can also be a DP slave on PROFIBUS DP or IO Device
on PROFINET IO.
b Interface modules (IM)
These connect the racks with each other.
b Signal modules (SM)
These adapt the signals from the controlled plant to the internal signal level or
control contactors, actuators, lights, etc. Signal modules are available as input
and output modules for digital and analog signals and can also be used to con-
nect sensors and actuators located in hazardous areas of zones 1 and 2.
b Function modules (FM)
These handle complex or time-critical processes independently of the CPU,
e.g. counting, position control, and closed-loop control.
b Communications processors (CP)
These connect the SIMATIC station with the subnets such as Industrial Ethernet,
PROFIBUS FMS, AS-Interface, or a serial point-to-point connection.
The distributed I/O modules connected to a station are also part of this station. If
the distributed I/O system is connected over PROFIBUS DP, a DP master controls
“its” DP slaves and thus the field units; if the connection is over PROFINET IO, an
IO-Controller controls the IO-Devices. The DP slaves or IO-Devices are integrated
in the address area of the centralized I/O system and are principally treated just
like the I/O modules installed locally in the central and expansion racks.
22. 2.2 The Micro PLC SIMATIC S7-200
21
2.2 The Micro PLC SIMATIC S7-200
The SIMATIC S7-200 is a compact micro PLC that replaces relay and contactor con-
trol arrangements and increasingly also specific electronic circuits in mechanical
and system engineering applications. It can be used as a stand-alone system or in
a network with other control systems. Various expansion modules for the connec-
tion to the machine or plant are available. STEP 7 Micro/WIN is used for program-
ming a SIMATIC S7-200.
Compact-type basic modules and expansion modules
There are various S7-200 basic modules graded by configuration and performance
capability. The basic module contains the CPU and – in different types and num-
bers for each basic module – integrated inputs and outputs at 24 V DC, 100 V
AC/120 V to 230 V AC, as well as relay outputs. Fast alarm and counter inputs en-
hance the real-time performance. A digital value can be set without a program-
ming device using a screwdriver via a potentiometer on the basic module.
You can increase the number of inputs/outputs by connecting an expansion mod-
ule. Such modules are available for both digital and analog inputs/outputs. The ex-
pansion modules are snapped onto the rail (e.g., standard DIN rail) next to the ba-
sic module and electrically connected by means of a bus connector.
Fig. 2.1 Setup and expansion options for an S7-200 station
Setup of an S7-200 station
Expansion options
S
23. 2 SIMATIC Controllers – the Hardware Platform
22
Operating modes of a CPU 200
A CPU 200 has two operating modes, STOP and RUN, which are indicated by LEDs
on the front of the CPU. The user program is not executed in STOP mode. The CPU
must be in STOP mode to load the user program or the hardware configuration. In
RUN mode, the CPU executes the control functions in the user program. To switch
between modes, use the mode switch on the CPU or the programming device in
online operation.
User memory in a CPU 200
The user memory of a CPU 200 consists of the program memory and the data
memory. When loading the user program to the CPU with a programming device,
the program code and the data are stored in an EEPROM memory, where they are
protected against power outages. The current data is then copied to the RAM area
where it is processed during runtime.
The user program can also be transferred via a memory module that can be
plugged into the CPU. Additional data such as recipes, data log configurations,
and documentation files in any format can be stored on this memory module. This
additional data can also be loaded from a programming device to the CPU if the
memory module is plugged in.
On a CPU 200, you can use a program to store a variable value in the failsafe
EEPROM memory area. Note that – due to the physical limitations of the medium –
only a limited number of write operations is allowed. Excessive writing, for exam-
ple with every program cycle, reduces the lifespan of the EEPROM memory. The
data on any plugged-in memory module is not changed.
Table 2.1 Quantity structure of the S7-200 CPUs
CPU Integrated I/O
Input/output channels
Expandable with
Expansion
modules (EM)
of the S7-22x series
Memory configuration
Data memory /
program memory /
with active RunTime Edit
Counter
Number /
frequency
DI DO AI *)
CPU 221 6 4 1 cannot be expanded 2 KB/ 4 KB 4/30 kHz
CPU 222 8 6 1 Max. 2 EMs 2 KB/ 4 KB 4/30 kHz
CPU 224 14 10 2 Max. 7 EMs 8 KB/ 12 KB/ 8 KB 6/30 kHz
CPU 224 XP 14 10 2 Max. 7 EMs 10 KB/ 16 KB/ 12 KB 2/200 kHz
4/30 kHz
CPU 226 24 16 2 Max. 7 EMs 10 KB/ 24 KB/ 16 KB 6/30 kHz
*) Analog potentiometer with 8-bit resolution
24. 2.2 The Micro PLC SIMATIC S7-200
23
Retentive behavior
Part of the data memory is reserved for retentive data defined by the user. Reten-
tive data is even retained if the supply voltage is interrupted. A high-performance
capacitor or an optional battery module bridges the loss of voltage.
If, when the power supply is switched on, the high-performance capacitor and – if
present – the optional battery module do not exhibit errors, the values of the re-
tentively configured variables (bit memories, timers, counters) are not changed
and the non-retentive memory areas are cleared.
If the contents of the RAM cannot be buffered, the CPU 200 deletes all user data,
retrieves the user program from the EEPROM memory area, and restores the first
14 bytes of the bit memories from the non-volatile memory, as long as these bytes
have previously been configured as retentive.
Communication capability just like a “large” station
Depending on its design, a CPU 200 hasone or two RS-485 interfaces, which as
point-to-point interfaces (PPI) permit the connection of programming and HMI
devices and allow linking to another CPU 200. As multi-point interfaces (MPI), they
permit the operation of a CPU 200 as MPI slave on an MPI master, e.g. a CPU
300/400. This interface can also be used as a freely programmable interface with
interrupt facility for serial data exchange with third-party devices such as barcode
readers using the ASCII protocol.
Various supplementary modules expand the communication possibilities, such as
the EM 241 modem for remote maintenance and diagnostics, the EM 277 DP mod-
ule for operation of a CPU 200 as PROFIBUS DP slave, and the CP 243-2 (AS-Inter-
face master), CP 243-1 (connection to Industrial Ethernet), and CP 243-1 IT (Indus-
trial Ethernet with IT communication) communications processors.
Operator control and monitoring with S7-200
For the S7-200 controllers, the Micro Panels are the ideal operator control and
monitoring devices. They are connected to the interface of the CPU by means of a
supplied cable. For a description of these HMI devices, refer to chapter 7.5 "Micro
Panels" on page 259.
Configuring and programming with STEP 7-Micro/Win
STEP 7-Micro/Win is the engineering software for the controllers of the S7-200 se-
ries and runs under Windows 2000 and Windows XP. A CPU 200 can be pro-
grammed with the statement list (STL), ladder logic (LAD), and function block dia-
gram (FBD) programming languages. These programming languages for S7-200
differ in function and handling from the programming languages for the other
SIMATIC S7 automation systems.
25. 2 SIMATIC Controllers – the Hardware Platform
24
2.3 The SIMATIC S7-1200 Modular Micro Controller
The youngest member of the controller family is the SIMATIC S7-1200. An S7-1200
automation system consists of a central processing unit which – depending on the
CPU version – can be expanded with digital and analog input and output modules.
Using the PROFINET interface, the central processing unit can be connected to In-
dustrial Ethernet. S7-1200 is configured and programmed inside TIA Portal using
STEP 7 Basic/Professional.
Compact design for S7-1200
Three central processing units with different performance capability in each of the
variants DC/DC/DC, DC/DC/relay, and AC/DC/relay are offered. The first specification
refers to the supply voltage (24 V DC, 85 to 264 V AC), the second to the signal volt-
age of the digital inputs (24 V DC), and the third to the type of digital outputs (24 V
DC electronic or relay outputs 5 to 30 V DC, 5 to 250 V AC). Table 2.2 shows the ex-
pandability and the memory configuration. Rapid counters with counting fre-
quencies of up to 100/200 kHz are integrated with the central processing unit,
which in connection with a pulse generator and the “Axis” technology object can
control a stepper motor or a servomotor with pulse interface.
Fig. 2.2 Setup and expansion options for an S7-1200 station
Expansion options
Setup of an S7-1200 station
S
x
x
26. 2.3 The SIMATIC S7-1200 Modular Micro Controller
25
A two-tier design is possible using a 2-meter long extension cable. But the number
of modules that can be used is not changed as a result.
Operating modes of the CPU
The CPU 1200 has the operating modes STOP, STARTUP, and RUN. In STOP, the us-
er program is not processed, but the CPU is capable of communication and can,
for example, be loaded with the user program. If the supply voltage is switched on,
the CPU is first in STOP mode, then switches to STARTUP mode, in which it param-
eterizes the modules and passes through a user start-up routine, and after an er-
ror-free start reaches RUN mode. Now the main user program is processed. In the
case of a “serious” error, the CPU switches from STARTUP or RUN mode back to
STOP mode.
The modes are switched with the programming device in online operation. A
mode switch is not provided.
The user memory consists of a load memory and a work memory
The user program is located on the CPU in two areas: in the load memory and
work memory. The load memory contains the entire user program including con-
figuration data; it is integrated into the CPU or available on a plug-in memory
card. The work memory in the CPU is integrated fast RAM that contains the execu-
tion-relevant program code and user data.
The programming device transfers the entire user program, including configura-
tion data, to the load memory. The operating system interprets the configuration
data, and parameterizes the CPU and – during startup – the I/O modules. The exe-
cution-relevant program code and user data are copied into the work memory.
Retentivity without backup battery
Retentivity means that the contents of a memory area remain after the supply volt-
age is switched off and on again. With a CPU 1200, this behavior makes possible a
retentive memory for bit memories and data variables and non-volatile load mem-
ory for the user program, so it does not require a backup battery. During runtime,
data areas such as recipes can be read from the load memory with a user program,
and other data areas such as archives can be written to the load memory.
Table 2.2 Quantity structure of the S7-1200 CPUs
CPU Onboard
input/output channels
Expandable with
SB = signal board
SM = signal module
CM = comm. module
Memory configuration
Load memory/
work memory /
retentive memory
digital analog
CPU 1211C 6 DI/4 DO 2 AI/- 1 SB, 3 CM 1 MB/25 KB/2 KB
CPU 1212C 8 DI/6 DO 2 AI/- 1 SB, 2 SM, 3 CM 1 MB/25 KB/2 KB
CPU 1214C 14 DI/10 DO 2 AI/- 1 SB, 8 SM, 3 CM 2 MB/50 KB/2 KB
27. 2 SIMATIC Controllers – the Hardware Platform
26
A memory card expands the load memory
The memory card for S7-1200 is an SD Card that has been
pre-formatted by Siemens. The memory card can be set as a
program card or a transfer card. As a program card, the
memory card replaces the integrated load memory and
must be inserted during operation of the CPU. As a transfer
card, the memory card allows the user program to be trans-
ferred without a programming device. It is also possible to
update the CPU firmware with a transfer card.
The signal board extends the onboard I/O
The signal board (SB) expands the onboard I/O without
changing the dimensions of the CPU. The associated slot is
located on the front of the CPU.
Signal boards are available with 24 V and 5 V digital inputs
and outputs, which can be operated at a frequency of up to
200 kHz. The frequency of the high-speed counters (HSC)
and pulse generators integrated into the CPU can thus be
increased.
Voltage transmitters (± 10 V), current transmitters (0 to 20
mA), thermocouples (type J or K), or resistance thermome-
ters (PT 100 or PT 1000) can be connected to a signal board
with analog input module. The signal board with analog
output module is available for ± 10 V output voltage or 0 to
20 mA output current.
High-speed counter
A high-speed counter (HSC) is a high-speed hardware counter in the CPU. The CPU
1211 contains three counters, the CPU 1212 has four counters, and the CPU 1214
has six counters. A high-speed counter as up/down counter has a counting range
of ±231
. There are special counter inputs on the CPU to capture the pulse train out-
put; these allow a maximum frequency of 100 kHz. If a signal board with fast in-
puts is used, the maximum counting frequency increases to 200 kHz.
Pulse generators
A pulse generator generates pulses at a special output channel. If the output chan-
nel to the onboard I/O belongs to the CPU, the maximum pulse frequency is 100
kHz. If the output channel is on the signal board, the maximum achievable fre-
quency increases to 200 kHz. Each CPU 1200 has two pulse generators. The pulse
generators have two modes of operation: PTO (pulse train output) and PWM
(pulse width modulation).
Fig. 2.3 SIMATIC
Memory Card
Fig. 2.4 Signal
Board 1223
28. 2.3 The SIMATIC S7-1200 Modular Micro Controller
27
“Axis” technology object
The axis technology object controls a stepper motor or a servomotor with pulse in-
terface. It forms the interface between the motion control instructions in the user
program and the drive. Motion profiles of the drive can be created using the job
table technology object.
A maximum of two axis technology objects can be set up in each CPU 1200. Each
axis technology object requires a pulse generator in PTO mode, an HSC, and a rap-
id pulse output channel.
“PID controller” technology object
The PID controller technology object is available in two versions: as a universal
controller (PID_Compact) for technical processes with continuous I/O signals and
as a controller for motor-operated devices such as valves (PID_3STEP) that use dig-
ital signals to open and close.
A PID controller requires an analog input channel for the actual value and an ana-
log output channel for the (analog) manipulated variable. Digital output channels
are required if the manipulated variable is issued as a pulse width modulated sig-
nal (PID_Compact) or as a close/open signal (PID_3STEP). The PID controller tech-
nology object calculates the PID shares independently during the self-adjustment
at initial start. Further optimization is possible by means of fine adjustment dur-
ing operation.
Peripheral expansion with digital and analog modules
The onboard peripherals of a CPU 1212 or CPU 1214 can be expanded with two or
eight signal modules (SM). Digital modules are available with 8 or 16 binary chan-
nels for 24 V input and output voltage or with relay outputs. Voltage transmitters,
current transmitters, thermocouples, or resistance thermometers can be connect-
ed to an analog input module with 8 or 16 analog channels. The analog output
module is available with 2 or 4 analog channels for ± 10 V output voltage or 0 to 20
mA output current. Which properties are important in the selection of I/O modules
can be seen in chapters 2.10 "Process Connection with Digital Modules" on page 47
and 2.11 "Process connection with analog modules" on page 48.
Communication for S7-1200
The PROFINET interface connects a CPU 1200 with other devices via Industrial
Ethernet. This can be a programming device, a Basic Panel, or another PLC. Open
User Communication performs the data exchange between the programmable
controllers. If only one device is connected, this can be done directly with a stan-
dard or crossover cable. The connection of multiple devices requires an interface
multiplier, for example, the CSM 1277 compact switch module, to which up to
three additional stations can be connected.
29. 2 SIMATIC Controllers – the Hardware Platform
28
A CPU 1200 may be the IO Controller in a PROFINET IO system. Additional infor-
mation on PROFINET IO is available in chapter 6.12 "Distributed I/O with PROFINET
IO" on page 225.
The CM 1241 communication module permits a point-to-point connection based
on RS232 or RS485. With a CB 1241 communication board – plugged into the front
of the CPU – a point-to-point connection based on RS485 can be set up without
changing the dimensions of the CPU. The following standard protocols are avail-
able: ASCII protocol, MODBUS protocol with RTU format, and USS drive protocol.
The CM 1242-5 (DP slave) and CM 1243-5 (DP master) communication modules
permit the connection of a CPU 1200 to a PROFIBUS DP master system. Further in-
formation on PROFIBUS DP can be found in chapter 6.15 "Distributed I/O with
PROFIBUS DP" on page 242.
Operator control and monitoring with S7-1200
The Basic Panels are the ideal operator control and monitoring devices for the
S7-1200 controllers. They are connected via the PROFINET interface and config-
ured with WinCC Basic, which is supplied with STEP 7 Basic/Professional V1x in-
side TIA Portal. The HMI devices for S7-1200 are described in chapter 7.2 "Basic
Panels" on page 255.
Configuring and programming with STEP 7 inside TIA Portal
A CPU 1200 is configured and programmed with the STEP 7 Basic/Professional en-
gineering software inside TIA Portal. Programming in ladder logic (LAD), function
block diagram (FBD), and structured control language (SCL) is possible with ver-
sion V11 of STEP 7 Basic and V2.x of the CPU firmware.
STEP 7 inside TIA Portal contains all functions for hardware configuration, net-
working with PROFIBUS and PROFINET, and programming and testing the user
program. The engineering software is described in chapter 3.4 "Editing projects
with STEP 7 inside TIA Portal" on page 70.
2.4 The SIMATIC S7-300 modular mini controller
SIMATIC S7-300 is the modular mini controller system for the lower and medium
performance ranges. Possible applications include the control of packaging, tex-
tile and special-purpose machinery. An S7-300 station consists of a central con-
troller and – as required – up to four expansion devices.
Central unit
The central controller contains the CPU and up to 8 I/O modules. The CPU requires
a supply voltage of 24 V DC, which, for example, can be drawn from one of the
power supplies on the mounting rail to the left of the CPU. A serial backplane bus
that transfers both the I/O signals and the parameterization data connects the mod-
30. 2.4 The SIMATIC S7-300 modular mini controller
29
ules to one another. The bus is routed from module to module via bus connectors. It
is only available where modules are inserted.
The slots in the rack are numbered: Slot 1 is reserved for the power supply, even if
there is no power supply, slot 2 is assigned to the CPU, and slot 3 is assigned to the
interface module (even if there is no interface module). Slots 4 to max. 11 are in-
tended for the I/O modules, which are plugged in without gaps. The slot number is
independent of the module width.
Expansion unit
If a single-tier configuration is not enough, with the CPU 314 and above you can
choose either a two-tier configuration (IM 365) or up to a four-tier configuration
(IM 360/IM 361) with up to 32 additional I/O modules.
The IM module is inserted between the CPU and the first I/O module. Like the cen-
tral rack, the expansion rack consists of a mounting rail with snapped-on mod-
ules. The receiver IM, which establishes the connection to the central rack, occu-
pies slot 2; a send IM leading to another rack occupies slot 3, and additional I/O
modules are inserted without gaps into the slots 4 to max. 11.
Fig. 2.5 Setup and expansion options for an S7-300 station
Multiple-tier configuration
Single-tier configuration
Setup of an S7-300 station
S S
Expansion options
PS PS
CR
CR
ER
IM
IM
31. 2 SIMATIC Controllers – the Hardware Platform
30
Broad field of application
A broad range of standard CPU 300s covers the lower and middle performance
range in the manufacturing industry. With a comprehensive range of modules and
flexible networking capability, the requirement is met for optimum adaptation to
the machine or plant to be controlled.
In addition to the equipment for standard CPUs, the 3xxC compact CPUs also con-
tain technological functions (counting, measuring, closed-loop control, position-
ing) with integral inputs/outputs, thus making compact design of mini controllers
possible.
The 3xxF failsafe CPUs permit the construction of a failsafe automation system
for plants with increased safety requirements. Failsafe and standard I/O modules
can be operated both in centralized and distributed configurations.
The 3xxT technology CPUs combine control functions with simple motion control
functions. The control component is designed like a standard CPU; it is config-
ured, parameterized, and programmed using STEP 7 V5.x. The technology objects
and the motion control component require the S7 Technology option package,
which is integrated in the SIMATIC Manager following installation.
Operating modes of a CPU 300
The CPU 300 has the operating modes STOP, STARTUP, HOLD, and RUN. After
switching on the power supply, the CPU is initially in STOP mode. The user pro-
gram is not processed, but the CPU is still capable of communication, i.e. the user
program can be loaded or the diagnostic buffer can be read, for example.
The CPU is switched into RUN mode with the mode switch on the CPU or with a
programming device in online mode. Here, the STARTUP mode is executed in
which the modules are parameterized and a user start-up routine is executed. The
main user program is executed in RUN mode.
Table 2.3 Quantity structure of standard S7-300 CPUs
CPU Address ranges Memory configuration
Load memory /
work memory /
retentive memory
Peripherals
(bytes)
Process image
(bytes) *)
Bit
memory
(bytes)
SIMATIC
timers
SIMATIC
counters
312 1024 1024 / 128 256 256 256 8 MB/32 KB/32 KB
314 1024 1024 / 128 256 256 256 8 MB/128 KB/64 KB
315-2 DP 2048 2048 / 128 2048 256 256 8 MB/256 KB/128 KB
315-2 PN/DP 2048 2048 / 128 2048 256 256 8 MB/384 KB/128 KB
317-2 DP 8192 2048 / 256 4096 512 512 8 MB/512 KB/256 KB
317-2 PN/DP 8192 8192 / 256 4096 512 512 8 MB/1024 KB/256 KB
319-3 PN/DP 8192 8192 / 256 8192 2048 2048 8 MB/2048 KB/700 KB
*) maximum/preset (both for inputs and outputs)
32. 2.4 The SIMATIC S7-300 modular mini controller
31
In the operating modes STARTUP and RUN, test functions can be performed that
lead to the HOLD mode. The execution of the user program is stopped at predeter-
mined points in the program. The outputs to the machine to be controlled are
switched off or set to a pre-defined value for safety reasons.
The user memory consists of a load memory and a work memory
The user program is located on the CPU in two areas: in the load memory and
work memory. The load memory contains the entire user program including con-
figuration data; it is located on a plug-in Micro Memory Card. The work memory
in the CPU is integrated fast RAM that contains the execution-relevant program
code and user data.
The programming device transfers the entire user program, including configura-
tion data, to the load memory. The operating system interprets the configuration
data, and parameterizes the CPU and – during startup – the I/O modules. The exe-
cution-relevant program code and user data are copied into the work memory.
Retentivity without backup battery
Retentivity means that the contents of a memory area remain after the supply volt-
age is switched off and on again. With a CPU 300 this behavior enables retentive
memory for bit memories, data variables, and timer and counter functions for
SIMATIC. The user program is also stored in non-volatile form in the load memory
on the Micro Memory Card so that a backup battery is not needed. During run-
time, data areas such as recipes can be read from the load memory with a user
program, and other data areas such as archives can be written to the load memory.
The load memory is a Micro Memory Card
With a CPU 300, the load memory is located on the Micro
Memory Card, with the result that a Micro Memory Card
must always be plugged in to operate a CPU 300. The Micro
Memory Card can also be used to transfer the user program
without a programming device to the CPU or to perform a
firmware update of the CPU.
Signal modules are the interface to the process
There is a wide range of signal modules available for the S7-
300. Different digital input modules with 8, 16, 32, or 64 bi-
nary channels record signals with voltages of 24 V DC with
sourcing or sinking output, 24 to 48 V DC or AC, 48 to 125 V
DC, and 120 V or 230 V AC. Depending on the design, the
digital output modules are available with 8, 16, 32, or 64 bi-
nary channels for 24 V output voltage with sourcing or sinking output, for 48 to
125 V DC, for 120 V or 230 V AC, and for relay outputs.
Fig. 2.6 SIMATIC
Micro Memory Card
33. 2 SIMATIC Controllers – the Hardware Platform
32
Voltage transmitters, current transmitters, thermocouples, or resistance ther-
mometers can be connected to an analog input module with 2, 6, or 8 analog chan-
nels. The analog output module is available with 2, 4, or 8 analog channels for
±10 V output voltage or 0 to 20 mA output current.
Which properties are important in the selection of I/O modules can be seen in
chapters 2.10 "Process Connection with Digital Modules" on page 47 and 2.11 "Pro-
cess connection with analog modules" on page 48.
Function modules relieve the CPU
A function module (FM) is a signal-preprocessing, “intelligent” module that pre-
pares and processes signals coming from the process independently from the
CPU, and either returns them to the process or makes them available at the CPU's
internal interface. Function modules handle functions that the CPU cannot usual-
ly execute quickly enough, such as counting pulses and positioning or control-
ling drives. The function modules available for S7-300 are listed in chapter 2.12
"FM modules relieve the CPU" on page 49.
Communication for S7-300
Each CPU 300 has an MPI to connect a programming device and for data exchange
with another CPU with MPI. With the CPU 316-2 PN/DP and above, this interface is
implemented as a combined MPI/DP interface. A CPU with a DP interface can be ei-
ther DP master or DP slave on PROFIBUS DP. Additional information on PROFIBUS
DP is available in chapter 6.15 "Distributed I/O with PROFIBUS DP" on page 242.
A CPU with PN interface can be both an IO controller and an IO device on
PROFINET IO. Further information on PROFINET IO can be found in chapter 6.12
"Distributed I/O with PROFINET IO" on page 225.
Communication processors to connect to PROFIBUS, Industrial Ethernet, AS-Inter-
face, and for point-to-point coupling are also available, as described in chapter
2.13 "Bus connection with communication modules" on page 50.
Operator control and monitoring with S7-300
The entire range of HMI devices and operator panels, as described in chapter 7
"Operator control and monitoring" on page 252, is available for the S7-300 control-
lers.
Configuration and programming with STEP 7
A CPU 300 can be configured and programmed with full functional scope (and
even for older modules) with STEP 7 V5.x. The programming languages for the us-
er program – ladder logic (LAD), function block diagram (FBD), and statement list
(STL) – are integrated in STEP 7. The Continuous Function Chart (CFC) graphical
program editor, the GRAPH sequence control, and the HiGraph state control are
34. 2.5 Technological functions of a CPU 300C
33
available as option packages for the structured control language (SCL) program-
ming language.
Configuration and programming with STEP 7 Professional inside TIA Portal ac-
counts for the modules which are currently being delivered. The programming
languages for the user program – ladder logic (LAD), function block diagram
(FBD), and statement list (STL), structured control language (SCL), as well as the
GRAPH sequence control – are integrated in STEP 7 Professional V11.
2.5 Technological functions of a CPU 300C
A compact CPU 300C contains technological functions in the operating system
that are used via integral system function blocks (SFBs) in the user program. The
technological functions are permanently assigned to the digital and analog in-
puts/outputs on the CPU. Some of the assignments overlap, and therefore some-
times not all technological functions can be used together.
In the case of open-loop positioning with analog output, the actual value is ac-
quired with asymmetric 24 V incremental encoders. The drive (power section) is
controlled using an analog output in the range ±10 V (voltage signal) or ±20 mA
(current signal). SFB 44 ANALOG is called in the user program. This SFB allows jog
mode, reference point approach, relative and absolute incremental mode, set ref-
erence point, delete distance to go, and linear measurement.
In the case of open-loop positioning with digital output, the actual value is ac-
quired with asymmetric 24 V incremental encoders. The drive (power section) is
controlled using four digital outputs that switch the direction of travel and the ve-
locity levels (rapid traverse or creep speed). SFB 46 DIGITAL is called in the user
program. This SFB allows jog mode, reference point approach, relative and abso-
lute incremental mode, set reference point, delete distance to go, and linear mea-
surement.
Depending on the CPU used, counting is performed at a frequency of up to 60
kHz using a permanently assigned 24 V digital input. SFB 47 COUNT is called in
the user program. This SFB allows continuous counting, single-shot counting, and
periodic counting. The gate function can start, stop, or interrupt counting. A com-
parator can force a digital output or trigger a hardware interrupt when a preset
count value has been reached.
In the case of a frequency measurement, the CPU counts the pulses within an
adjustable time window. The time window can be set within the range 10 ms to
10,000 ms in steps of 1 ms. Depending on the CPU used, a frequency of up to 60 kHz
can be measured. In the user program, you call SFB 48 FREQUENC. The gate func-
tion starts or stops the measurement. If the frequency reaches a lower or upper
limit, a digital output can be forced or a process interrupt can be triggered.
Pulse width modulation converts a numeric value into a pulse train with the
relevant pulse/pause ratio and outputs this at a digital output. The output fre-
35. 2 SIMATIC Controllers – the Hardware Platform
34
quency is up to 2.5 kHz and the minimum pulse duration is 200 µs. Pulse width
modulation is integrated into the user program with SFB 49 PULSE. The gate
function starts or stops output of the pulse train.
Depending on the CPU used, the ASCII, 3964(R) and RK512 protocols are available
for point-to-point connection. Up to 1024 bytes can be transferred at a data rate
of 19.2 kbit/s (full duplex) or 38.4 kbit/s (half duplex). SFBs 60 and 65 form the in-
terface to the user program.
Depending on the CPU used, the ASCII, 3964(R) and RK512 protocols are available
for point-to-point connection. Up to 1024 bytes can be transferred at a data rate
of 19.2 kbit/s (full duplex) or 38.4 kbit/s (half duplex). SFBs 60 and 65 form the in-
terface to the user program.
The closed-loop control functions are software controllers implemented with
SFB 41 CONT_C (PID controller with continuous manipulated variable output,
suitable for two-step or three-step controls), SFB 42 CONT_S (PI controller with
binary manipulated variable output without position feedback), and SFB 43
PULSEGEN (PID two-step or three-step controller with pulse width modulation).
Fig. 2.7 Performance features of a compact CPU 314C-2 PN/DP
Compact CPU 314C
Technological functions
•
•
•
36. 2.6 SIMATIC S7-400 for demanding tasks
35
2.6 SIMATIC S7-400 for demanding tasks
SIMATIC S7-400 is the highest-performance SIMATIC S7 controller. As an automa-
tion platform for system solutions in production and process engineering, the
S7-400 is characterized primarily by its modularity and performance reserves. An
S7-400 station consists of a central controller and – as required – of up to 21 ex-
pansion devices.
Fig. 2.8 Setup and expansion options for an S7-400 station
Setup of an S7-400 station
CR ER
ER
ER
ER
ER
Expansion options
CR Central rack
ER Expansion rack
IM Interface module
Max. 21 expansion racks can be connected to a central rack.
37. 2 SIMATIC Controllers – the Hardware Platform
36
Central rack
The S7-400 mounting rack, an aluminum DIN rail of a fixed length with backplane
bus and bus connectors, can be used as a central rack (CR), an expansion rack (ER),
or as a combination of both (UR, universal rack).
For the S7-400 there are central racks available with 18, 9, or 4 slots (UR1, UR2, or
CR3) of fixed mounting widths. The power supply unit and the CPU also occupy
module slots, possibly even 2 slots or more per module. Typically, the module ar-
rangement begins on the left side with the power supply, followed by the CPU and
the I/O modules, where the slots can be freely chosen, even with gaps. On the
right-hand side of the rack are the interface modules to any expansion racks. The
backplane bus, consisting of the parallel P bus for the I/O signals and the serial
C-bus for the transmission of parameter and diagnostic data sets, connects the
slots to each other.
The CR2 segmental rack allows you to use two CPUs on a common power supply.
The CPUs exchange data over the communication bus, but each uses its own I/O
bus to communicate with its I/O modules. The left segment provides 10 module
slots, the right segment 8 module slots.
The UR2-H segmental rack consists of 2 segments with 9 module slots each. You
can use it as a central rack or as an expansion rack in standard S7-400 stations or
high-availability S7-400H stations. Each segment requires its own power supply;
I/O bus and communication bus are separate.
Fig. 2.9 Central rack for S7-400
CPU
PS
CPU CPU
PS
CPU CPU
PS PS
P bus P bus
P bus P bus
P bus
C bus C bus
C bus
C bus
Backplane bus in an S7-400 central rack
Universal rack UR2-H
Central rack CR2
Universal rack UR1
38. 2.6 SIMATIC S7-400 for demanding tasks
37
Expansion racks
If there is insufficient space for the I/O modules in the central rack, or if you want
to install modules at a distance, you supplement the station with one or more ex-
pansion units. Universal racks and expansion racks can be used as expansion
units, with up to 21 on one central rack. The send and receive interfaces that are
used in pairs transmit the signals over various distances:
The ER1 and ER2 expansion racks with 18 or 9 slots are intended for “simple” sig-
nal modules which do not trigger process alarms, do not require a 24 V DC sup-
ply over the P bus nor a backup supply, and are not equipped with a communica-
tion bus interface. The UR1 and UR2 racks are equipped with a communication
bus if they are used either as central racks or expansion racks with the ID num-
bers 1 to 6.
Connection of SIMATIC S5 modules
The IM 463-2 interface module is used for connecting SIMATIC S5 expansion units
(EG 183U, EG 185U, EG 186U, ER 701-2 and ER 701-3) to an S7-400 station. These
expansion units can again be expanded in a centralized arrangement. An IM 314
interface module in the S5 expansion unit establishes the connection. In such an
arrangement you can use any of the digital and analog modules listed for the spec-
ified expansion units. In a decentralized setup, you can connect up to 16 S5 expan-
sion units to one S7- 400 station.
If you want to use a single S5 module in an S7-400 station, you have to make use of
an adapter module.
Versatile application
A broad range of standard CPU 400s covers the middle and upper performance
range in the manufacturing and process engineering. With a comprehensive
range of modules and flexible networking capability, the requirement is met for
optimum adaptation of the plant or process to be controlled.
The 4xxF failsafe CPUs permit the construction of a failsafe automation system
for plants with increased safety requirements. The failsafe I/O modules offer dis-
tributed connection to the failsafe PROFIsafe bus protocol via PROFIBUS DP or
PROFINET IO.
Interface pair in central controller
in expansion unit
IM 460-0
IM 461-0
IM 460-1
IM 461-1
IM 460-3
IM 461-3
Max. distance 5 m 1.5 m 102 m
Max. number of connectable expansion units 8 2 8
Transmitting buses (P = peripheral bus, C = communications bus) P + C P P + C
Supply voltage is transferred No Yes No
39. 2 SIMATIC Controllers – the Hardware Platform
38
The fault-tolerant 4xxH CPUs are used in control systems in which two CPUs –
one “master” and the other “hot standby” – control a system in parallel. If the mas-
ter system fails, the reserve CPU can smoothly take control of the system.
Enhanced performance with multiprocessing
You can convert the S7-400 station into a multiprocessing controller by inserting
several CPUs (4 max.). Make sure you select CPUs that are specified for this type of
operation which is also called “multicomputing.” As soon as you install more than
one CPU, the programmable controller will automatically assume multiprocessing
operation. All CPUs have the same operating mode. This means they start together
and also all of them go to STOP if one of the CPUs fails. Each CPU executes its own
user program independently of the other CPUs.
Each I/O module is assigned to one specific processor. This includes its address
and alarms. All I/O modules are located in the same I/O bus segment. This means
that you must give them different addresses even though they refer to different
CPUs. The same rule applies to distributed I/O modules. Although each CPU can
operate one or several DP master systems independently from the other proces-
sors, each centralized and distributed module must have its unique address (I/O
bus addresses) in the overall system.
Operating modes of a CPU 400
The CPU 400 has the operating modes STOP, STARTUP, HOLD, and RUN. After
switching on the power supply, the CPU is initially in STOP mode. The user pro-
gram is not processed, but the CPU is still capable of communication, i.e. the user
program can be loaded or the diagnostic buffer can be read, for example.
Table 2.4 Quantity structure of standard S7-400 CPUs
CPU Address ranges Memory configuration
Load memory FEPROM /
Load memory RAM integrated
**) /
work memory ***)
Peripher-
als
(bytes)
Process
image
(bytes) *)
Bit
mem-
ory
(bytes)
SIMATIC
timers
SIMATIC
coun-
ters
412-1
412-2
412-2 PN
4096 4096 / 128 4096 2048 2048 64 MB/512 KB/144 KB
64 MB/512 KB/256 KB
64 MB/512 KB/512 KB
414-2
414-3
414-3 PN/DP
8192 8192 / 256 8192 2048 2048 64 MB/512 KB/0.5 MB
64 MB/512 KB/1.4 MB
64 MB/512 KB/2 MB
416-2
416-3
416-3 PN/DP
16 384 16 384 / 512 16 384 2048 2048 64 MB/1 MB/2.8 MB
64 MB/1 MB/5.6 MB
64 MB/1 MB/8 MB
417-4 16 364 16 384 / 1024 16 384 2048 2048 64 MB/1 MB/15 MB
*) maximum / preset (both for inputs and outputs)
**) A RAM load memory on the memory card has the same size as a FEPROM load memory
***) Each for both program and data
40. 2.6 SIMATIC S7-400 for demanding tasks
39
The CPU is switched into RUN mode with the mode switch or with a programming
device in online mode. Here, the STARTUP mode is executed in which the modules
are parameterized and a user start-up routine is executed. The main user program
is executed in RUN mode.
In the operating modes STARTUP and RUN, test functions can be performed that
lead to the HOLD mode. The execution of the user program is stopped at predeter-
mined points in the program. The outputs to the machine to be controlled are
switched off or set to a pre-defined value for safety reasons.
The user memory consists of a load memory and a work memory
The user program is located on the CPU in two areas: in the load memory and
work memory. The load memory contains the entire user program including con-
figuration data; it is integrated with the CPU and can be expanded with a memory
card. The work memory is fast RAM that contains the execution-relevant program
code and user data.
The programming device transfers the entire user program, including configura-
tion data, to the load memory. The operating system interprets the configuration
data, and parameterizes the CPU and – during startup – the I/O modules. The exe-
cution-relevant program code and user data are copied into the work memory.
A memory card expands the load memory
The size of the RAM load memory integrated on the CPU is
sufficient for smaller user programs. For large user pro-
grams, the load memory card be expanded with a RAM
memory card. If the user program has to be stored failsafe, a
FEPROM memory card is used.
The FEPROM memory card can also be used to perform a
firmware update of the CPU.
Voltage buffering of an S7-400
The RAM load and work memory is buffered with a backup
battery in the power supply module. It is also possible to
connect the CPU to an external backup voltage. Bit memo-
ries, SIMATIC timers and counters, and data blocks can be included in the buffered
memory area.
Signal modules are the interface to the process
For the S7-400, various digital input modules are available with 16 or 32 binary
channels. They can record the signals with voltages of 24 V DC, 24 to 60 V or 120 V
DC or AC, and 120 V or 230 V AC. Depending on the model, the digital output mod-
ules are available with 16 or 32 binary channels for 24 V output voltage and for
120 V or 230 V AC.
Fig. 2.10 SIMATIC
RAM memory card
41. 2 SIMATIC Controllers – the Hardware Platform
40
Voltage transmitters, current transmitters, thermocouples, or resistance ther-
mometers can be connected to an analog input module with 8 or 16 analog chan-
nels. The analog output module is available with 8 analog channels for ±10 V out-
put voltage or 0 to 20 mA output current.
Which properties are important in the selection of I/O modules can be seen in
chapters 2.10 "Process Connection with Digital Modules" on page 47 and 2.11 "Pro-
cess connection with analog modules" on page 48.
Function modules relieve the CPU
A function module (FM) is a signal-preprocessing, “intelligent” module that pre-
pares and processes signals coming from the process independently from the
CPU, and either returns them to the process or makes them available at the CPU's
internal interface. Function modules handle functions that the CPU cannot usually
execute quickly enough, such as counting pulses and positioning or controlling
drives. The function modules available for S7-400 are listed in chapter 2.12 "FM
modules relieve the CPU" on page 49.
Communication for S7-400
Each CPU 400 has an MPI to connect a programming device and for data exchange
with another CPU with MPI. A CPU with a DP interface can be either DP master or
DP slave on PROFIBUS DP. On the CPU 414-3, 416-3, and 417-4, an interface mod-
ule (or two on the CPU 414-4) can be plugged in to allow an additional DP interface
with DP master or DP slave functionality. Additional information on PROFIBUS DP
is available in chapter 6.15 "Distributed I/O with PROFIBUS DP" on page 242.
A CPU with PN interface can be both an IO controller and an IO device on
PROFINET IO. Further information on PROFINET IO can be found in chapter 6.12
"Distributed I/O with PROFINET IO" on page 225.
In addition, communication processors to connect to PROFIBUS, Industrial Ether-
net, and point-to-point coupling are also available, as listed in chapter 2.13 "Bus
connection with communication modules" on page 50.
Operator control and monitoring with S7-400
The entire range of HMI devices and operator panels, as described in chapter 7
"Operator control and monitoring" on page 252, is available for the S7-400 control-
lers.
Configuration and programming with STEP 7
A CPU 400 can be configured and programmed with full functional scope (and
even for older modules) with STEP 7 V5.x. The programming languages for the us-
er program – ladder logic (LAD), function block diagram (FBD), and statement list
(STL) – are integrated in STEP 7. The Continuous Function Chart (CFC) graphical
program editor, the GRAPH sequence control, and the HiGraph state control are
42. 2.7 High Availability with SIMATIC
41
available as option packages for the structured control language (SCL) program-
ming language.
Configuration and programming with STEP 7 Professional inside TIA Portal ac-
counts for the modules which are currently being delivered. The programming
languages for the user program – ladder logic (LAD), function block diagram
(FBD), and statement list (STL), structured control language (SCL), as well as the
GRAPH sequence control – are integrated in STEP 7 Professional V11.
2.7 High Availability with SIMATIC
For slow processes: software redundancy with standard components
The standard SIMATIC S7-300/400 components allow you to build a redundant sys-
tem based on software. In such a redundant setup, a standby station assumes con-
trol of the process if the master station breaks down. High availability through
software redundancy is suitable for slow processes as the switchover to the stand-
by station could take up to several seconds depending on the configuration of the
Fig. 2.11 Example of a setup with software redundancy
Software redundancy
Redundant link
PROFIBUS
DP
S
S7-400 (master CPU)
S7-300 (reserve CPU)
43. 2 SIMATIC Controllers – the Hardware Platform
42
PLCs. During this period, all process signals are “frozen”. The standby station
then continues processing with the most recent valid data from the master sta-
tion.
Both participating CPUs exchange the current data over a (random) subnet. Exist-
ing communication links can also be used. Single-channel redundancy of the in-
put/output modules is implemented with distributed I/O (ET 200M with IM 153-2
interface module for redundant PROFIBUS DP). Each CPU can also independently
control non-redundant I/O, both in central and distributed configurations.
The “Software Redundancy” option package is available for configuration.
High availability using hot standby: SIMATIC S7-400H
SIMATIC S7-400H is a highly available programmable logic controller using a re-
dundant configuration with two CPUs 4xxH or 4xxF/H, each equipped with a syn-
chronization module for data synchronization via fiber-optic cable. Both devices
work in “hot standby” mode with automatic, bumpless switchover to the standby
unit, which takes over full control of the user program if the primary unit fails.
The high-availability system can comprise either two separate central racks UR1 or
UR2 or one split rack UR2-H. Alongside the always redundant power supplies and
CPUs, you can connect peripherals with normal or high availability (Fig. 2.12).
A high-availability S7 connection over an Industrial Ethernet or PROFIBUS subnet
can consist of up to four subordinate connections depending on the configura-
tion. Of these, two are always established (active) in order to retain the communi-
cation in the event of a fault.
The required software “S7 H Systems” is included in STEP 7 V5.3 or higher. The li-
brary “Redundant IO (V1)” supports you when scanning and controlling the redun-
dant I/O.
2.8 Safety Integrated with SIMATIC S7
For increased safety requirements: safety-related SIMATIC
Failsafe automation systems control processes and machines with the aim of re-
ducing the hazards to personnel and the environment as far as possible without
restricting production more than is absolutely necessary. The safety-related
SIMATIC systems are used in cases where the safe state can be achieved by imme-
diate shutdown. They comply with the following safety requirements: Safety In-
tegrity Level SIL1 to SIL3 in accordance with IEC 61058 and Category 1 to Category
4 in accordance with EN 954-1.
The enhanced safety functions are essentially achieved by means of a safety-relat-
ed user program in an appropriately designed CPU (F-CPU), by means of failsafe
I/O modules (F modules), and by the higher-level PROFIsafe safety profile with the
PROFIBUS DP or PROFINET IO “standard” bus systems.
44. 2.8 Safety Integrated with SIMATIC S7
43
Fig. 2.12 Process I/O designs in a SIMATIC S7-400H system
Single-channel single-sided configuration
Redundant single-sided configuration Redundant switched configuration
Single-channel switched configuration
SIMATIC S7-400H
45. 2 SIMATIC Controllers – the Hardware Platform
44
Failsafe I/O
The F modules required for safety operation are available in different versions. In
the S7-300 design, F modules are provided for centralized use in a failsafe S7-300
station or for distributed use in an ET 200M station. Failsafe power modules and
electronic modules are used centrally and in distributed configurations in an ET
200S station. Using S7 Distributed Safety, you can also connect failsafe PROFIBUS
DP standard slaves.
F modules can also be used in standard operation with increased diagnostics re-
quirements. You can have standard operation and safety-related operation com-
bined in the same automation system, and on the S7-400FH even with fault toler-
ance.
Focusing on machine control application: S7 Distributed Safety
S7 Distributed Safety comprises a failsafe CPU
and failsafe modules connected to the F CPU via
PROFIBUS DP or PROFINET IO. Here, the PRO-
FIsafe bus profile guarantees failsafe transmis-
sion. Currently available as F CPUs are the CPU
3xxF-2 for the S7-300, the CPU 416F-2 for the
S7-400, and the IM151-7 F CPU basic module
for the ET 200S.
Together with the F modules, the following con-
figurations are available: Centralized configu-
ration with failsafe modules on the S7-300 with
CPU 3xxF-2 and on the ET 200S with IM 151-7
F-CPU, distributed configuration with ET 200M,
ET 200S, ET 200eco or ET 200pro stations with
failsafe modules as well as failsafe DP standard
slaves and failsafe IO standard devices connect-
ed to a centralized S7-300/400 station with F-
CPU.
The safety-related program section is programmed with the languages F LAD and
F FBD with a limited operation set and fewer data types than the basic languages.
Both languages are included in the “S7 Distributed Safety” option package that
you require for configuring and programming the safety mode. The option pack-
age also contains a block library for the safety program with F blocks and tem-
plates.
Focusing on the process industry: S7 F/FH Systems
S7 F/FH Systems is based on the S7-400 automation system in the version with
normal availability and in the fault-tolerant version. The F modules required for
safety operation are connected to the S7-400 station via PROFIBUS DP with the
PROFIsafe bus profile. The following are used: ET 200M stations with F modules of
Fig. 2.13 CPU 315F-2 PN/DP
46. 2.8 Safety Integrated with SIMATIC S7
45
S7-300 design, ET 200S stations with safety-related power and electronics mod-
ules, and ET 200eco F modules.
In the fault tolerant version S7-400FH, ET 200M stations are controlled via a re-
dundant PROFIBUS. If a detected fault results in STOP of the master CPU on the
S7-400FH, the system performs a reaction-free switchover to the hot standby CPU.
An F-Runtime license must be loaded onto each CPU to operate the S7-400F/FH.
STEP 7 V5.1 or higher is required for configuration. The option package “S7 F Sys-
tems” is required for configuring the F modules and programming the failsafe pro-
gram section. Also required are the option package “CFC” from V5.0 SP3, the option
package “S7-SCL” from V5.0, and for the fault-tolerant functions the option pack-
age “S7 H Systems” from V5.1.
With CFC (Continuous Function Chart), you interconnect special function blocks
from the supplied F library. As well as functions for programming safety func-
tions, the blocks also contain functions for detecting and responding to faults. In
the event of failures and faults, the F system can thus be maintained in a safe state
Fig. 2.14 Design versions for S7 Distributed Safety and S7 FH Systems
S7 Distributed Safety S7 FH system
s
Safety Integrated for SIMATIC S7
ET 200M
ET 200S
ET 200S
IM 151-xF CP
U
PROFIBUS DP
with PROFIsafe
PROFINET
IO
PROFIBUS
DP
with
PROFIsafe
ET 200M
ET 200M
S7-4xxFH
S7-4xxF
S
ET 200pro
ET 200eco
S
S
S7-3xxF
S
47. 2 SIMATIC Controllers – the Hardware Platform
46
or changed to a safe state. If a fault is detected in the safety program, the F section
of the plant is switched off, whereas the remaining part can continue to operate.
2.9 Use Under Difficult Conditions: SIPLUS
“SIPLUS extreme” is the product range with hardened components for use in
harsh environments. Standard devices that have been specially converted and re-
fined for the respective application are used as the basis for the SIPLUS compo-
nents.
Harsh environmental conditions can include:
b Ambient temperature range from
–40/–25 °C to +60/+70 °C
b Condensation, increased humidity,
increased degree of protection (dust,
water)
b Extreme loading by media
(conformal coating), e.g. toxic
atmospheres
b Increased mechanical load, increased
electrical immunity
b Voltage ranges deviating from the
standard
b Ambient conditions on rail vehicles
SIPLUS modules are manufactured on re-
quest for the environmental conditions
specified. Please therefore observe the technical specifications of the respective
module.
SIPLUS modules are available for SIMATIC programmable controllers in all de-
signs: S7-200, S7-1200, S7-300, S7-400, ET 200, and for other Siemens device fami-
lies. SIPLUS modules include power supplies; CPUs, signal, function and commu-
nication modules, and numerous special modules.
Configuring of SIPLUS modules
The functionality of a SIPLUS module is the same as that of the corresponding
standard module; the Order No. (MLFB, machine-readable product code) begins
with 6AG1. SIPLUS modules are not included with their order numbers in the
hardware catalog of STEP 7.
Since the SIPLUS modules have the same functions as existing modules, you can
use the corresponding equivalent type (the standard module) when configuring.
Fig. 2.15
SIPLUS CPU 1214C DC/DC/DC,
6AG1 214-1AE30-0XB0
based on 6ES7 214-1AE30-0XB0
48. 2.10 Process Connection with Digital Modules
47
This equivalent type (“based on 6ES7 … ”) can be found on the device's nameplate,
in the SIPLUS data sheets, and on the Internet in the Siemens Industry Mall.
2.10 Process Connection with Digital Modules
Digital modules are signal converters for binary process signals. The CPU of the
SIMATIC station receives information about the operating modes of the process
through digital input modules and intervenes in the process through digital out-
put modules. The digital signals between backplane bus and process are isolated
by means of optocouplers.
Digital modules are available with one, two, four, or eight bytes corresponding to
8, 16, 32 or 64 signals. Digital modules are preferably addressed in the process im-
age so that the signal states can be processed bit by bit. User-friendly digital mod-
ules supply diagnostic information about the state of the module.
Fig. 2.16 shows digital input
modules with the various de-
signs of the SIMATIC automa-
tion families in approximately
the same scale. From left to
right, these are the modules
b EM 221
(S7-200: DI 8 × 24 V DC)
b SM 1221
(S7-1200: DI 16 × 24 V DC)
b SM 321
(S7-300: DI 16 × 24 V DC)
b SM 421
(S7-400: DI 32 × 24 V DC).
The same designs (appearance,
proportions) apply for the entire module range of signal modules (SM), function
modules (FM), and communication modules (CP).
Digital input modules
Digital input modules convert the external signal voltage, usually 24 V DC or 120
V/230 V AC, into the internal signal level. The connected sensor must be within the
permissible voltage range and provide the required input current with the signal
status “1” so that the module can switch reliably. In addition, the input signals are
filtered, i.e. interference on the lines is suppressed and glitches eliminated. The
filtering results in the input signals being delayed. For digital input modules with
hardware interrupt triggering, you can reduce the input delay. A compromise
Fig. 2.16
I/O modules in different
designs
49. 2 SIMATIC Controllers – the Hardware Platform
48
must be found here between interference resistance (long delay) and fast signal
recording (short delay).
Digital output modules
To be able to intervene in the process, the CPU requires signal converters which
convert the internal signal states to the voltage and current levels used in the
plant or process. The digital output modules are equipped with a data memory
which stores the received data and then passes this information on to an amplifi-
er. The amplifier provides the required switching capacity. For d.c. voltage amplifi-
ers, short-circuit protection is implemented electronically, whereas a.c. voltage
amplifiers are protected by means of fine-wire fuses.
When you select a digital output module, you consider its switching capacity, its
total permissible load and the residual current. The residual current at signal
state “0” must not fall below the permitted limit, otherwise the activated device
will not respond to a stop signal.
In the operating modes STOP and HALT, and also during the start-up period lead-
ing to program execution, an output disable signal (OD signal) disables all digital
output modules. In this state, they either do not supply any voltage, supply a de-
fined substitute value, or maintain the value set last.
Explosion-proof digital modules
SIMATIC explosion-proof digital modules are “associated electrical equipment”
with “intrinsically safe” protection ([EEx ib] IIC acc. to DIN EN 50020). They are ap-
proved for the connection of intrinsically safe electrical devices located in zone 1
or 2. The modules are installed outside hazardous areas. The load voltage of 24V
DC is routed through the LK393 cable duct. Explosion-proof modules are used in
S7-300 stations or as distributed I/O in ET 200M stations. You use STEP 7 to config-
ure these modules.
2.11 Process connection with analog modules
Analog modules are signal converters for analog process signals. Analog input
modules convert the analog signals coming from the process or plant to digital
signals which can be processed by the CPU of the SIMATIC station. Analog output
modules convert the digital signals from the SIMATIC station to analog signals for
the process, such as setpoint values for actuators. Each analog quantity, such as a
measuring or setpoint value, occupies a “channel” on the module. Analog mod-
ules are available with 4, 8 or 16 channels which correspond to 8, 16 or 32 bytes. A
digitized analog value is internally represented as a 16-bit integer (data type INT).
Advanced analog modules supply diagnostic information about the state of the
module or limit value information.
